Lawyers threaten researcher over key-cloning bug in high-security lock

http://arstechnica.com/security/2015/05/05/lawyers-threaten-researcher-over-key-cloning-bug-in-high-security-lock/

by wglb • 11 years ago

160 85 11 years ago

istvan__• 11 years ago

I am wondering how can you dodge this if you are a security researcher in the US.

smoyer2• 11 years ago

Publish the fact that it can be done without publishing how to do it (yes, you have to be reputable). I think it's interesting that the lawyer focused on the fact that they depackaged the chip when the (in my mind) bigger vulnerabilities don't require that.

I think it would be interesting to sue a company like CyberLock for false advertising ... "impossible to clone keys" is clearly false.

ceejayoz5• 11 years ago

Publish the fact that it can be done without publishing how to do it (yes, you have to be reputable).

Chances are that just changes the lawsuits to defamation ones.

poizan422• 11 years ago

Depending on you purpose you could publish it anonymously - just make damn sure it can't be traced back to you. It won't help you much if your goal is to built reputation or you want to be able to talk about it.

matheist• 11 years ago

So, like level 2 of microcorruption?

makomk• 11 years ago

Not really. Despite the name and theme, Microcorruption was about the kinds of vulnerabilities that exist in desktop and server systems; actual embedded exploration is very different. Typically there's a site key sent from the lock to the key, which authenticates itself with a second site key - often all in plaintext, on the more insecure systems. So you just sniff the communications.

jonathanmayer• 11 years ago

(Background: I'm a computer security researcher and lawyer at Stanford.)

When a security researcher gets threatened, there's a tendency to lambast the lawyers. I think that's unfortunate.

It is, very often, the client that demands an aggressive response. A lawyer should counsel against, since nastygrams to researchers tend to summon negative attention. Not being a jerk is also a plus.

That said, if a client insists--and they often do--the lawyers have little choice. Professional ethics generally require following the client's direction, and there isn't sufficient time to withdraw as counsel.

So, for the most part: Don't blame the lawyers, blame the DMCA. It's the law that's broken.

click170• 11 years ago

That's a fair argument for not blaming the lawyers. But I don't think that line of reasoning deflects blame away from the company demanding they pursue legal action.

shaunol• 11 years ago

Is it generally a lawyer's job to advise a client when a case may attract negative publicity? Do they even care?

socceroos• 11 years ago

I'm pretty sure that 'cha-ching' is mostly what matters. Hate to be cynical but..

eli• 11 years ago

Yes, of course. Advising clients to take actions that make them look bad doesn't sound like a way to expand your practice.

madez10• 11 years ago

You have responsability for your actions even if you're legaly forced to them. This sane principle was officialized in the Nuremberg trials [1].

Edit0: In fact, the principles were more specific to international law vs national law and orders. However, the idea behind is still sane even if you don't violate international law.

Edit1: It's about recognizing personal responsibility.

Edit2: Those who disagree, why?

[1] http://en.m.wikipedia.org/wiki/Nuremberg_principles

Rangi42• 11 years ago

There is value in doing your legal duty, even if some people think your duty is to do a bad thing. "I was just doing my job" is not considered a sufficient defense of Nazi actions because their actions were so terrible that being legally required to do them does not mitigate that. Threatening legal action, on the other hand, is an ordinary event that can be easily excused as "just what lawyers have to do for their clients."

karlmdavis• 11 years ago

I don't know this for sure, but I seem to recall that lawyer's professional rules of conduct require them to not leave clients in the lurch, without providing them ample warning to find new counsel.

I believe this is what the GP poster is mentioning when he says that there often isn't "sufficient time to withdraw."

MichaelCrawford2• 11 years ago

There are plenty of times that one has a duty to violate the law. Consider that the US Supreme Court does not render advisory opinions; to overturn an unconstitutional law, one must violate it first, then defend oneself all the way to the Supremes.

This is a very risky proposition as it happens all the time that the Supreme Court will deny certiori over some petty issue.

If you wonder why I use my real name here and elsewhere online, it's because I regard it as my duty to - someday - defend myself before the Supreme Court.

brownbat• 11 years ago

Those who disagree, why?

They probably feel that the Nuremberg trials are a hyperbolic example here, and worry that line of argument brushes a little too close to Godwin's Law.

Upshot, we probably all agree with you that everyone has personal responsibility for their actions. There are still situations where we want attorneys to listen to their clients though.

kemitchell2• 11 years ago

Nuremberg? Wasn't the story about computer nerds or something?

http://www.americanbar.org/groups/professional_responsibilit...

Many state bar associations have rules like that one. Lawyers can make good-faith arguments that their client's behavior isn't illegal. They can't break the law for their clients or help their clients break the law.

No one should be stuck, unable to get a lawyer and put up a fair legal fight, just because some part of the population condemns them as amoral, but can't pass a law expressing that condemnation that stands up to civil liberties challenge. Lawyers should serve hated people, too, and ideally do for them just as they would do for themselves if they understood the law and the system.

Lawyers who can do that for truly loathsome clients are superheroes. They often set aside deep feelings and strongly held personal convictions in the service of the greater value of a fairer legal system. It's a real-life Gom Jabbar test, and repeat sittings have driven many good lawyers to self-destruction, one way or another.

So: If you don't want lawyers helping assholes, try and pass a law against being an asshole. It would be vague. Prejudiced assholes would wield it against legitimate non-assholes. Good lawyers defending actual assholes would kill it in court.

More succinctly: https://youtu.be/WMqReTJkjjg?t=2m10s

lotsofmangos6• 11 years ago

If all that Hitler had done was get Goebbels to send out threatening letters to people who remarked that he had left his door unlocked, then referencing Nuremberg over lawyers sending cease and desist letters on behalf of a padlock manufacturer might not seem quite so ridiculous.

higherpurpose• 11 years ago

What about when EFF tries to kill bogus patents and trial lawyers lobby against it because they make too much money from bogus patents? Can we blame then lawyers then?

What I'm trying to say is that perhaps the sometimes it's not just the law's fault - but the lawyers also like having said law and abusing it.

Also, this is going to get even worse if Obama has his way with the new "enhanced" CFAA law that can jail people even for breaking a company's ToS.

thaumasiotes2• 11 years ago

Hmmm... compare http://www.loweringthebar.net/2015/03/obligation-to-make-sen... .

According to that one, it is not acceptable for a lawyer to file the petition his client wants him to file, if that petition doesn't meet the court's standards. If judges can censure lawyers for acceding to their clients' demands, so can the rest of us.

How much time does it take to withdraw as counsel?

mkopinsky• 11 years ago

There's a big difference between a court filing and lawyerly nastygram. By sending inappropriate nastygrams you're not wasting the court's time.

meowface3• 11 years ago

Were these vulnerabilities disclosed to CyberLock at all before the results were published? If not, I can't blame them for being angry. Not saying they shouldn't be publicly disclosed in addition to private disclosure, but you have to give a company a fair chance to review the vulnerabilities and at least respond to you before you publish.

AngrySkillzz• 11 years ago

They told the company at least a day beforehand: https://t.co/dnvq8F3Ad0

Anechoic• 11 years ago

For anyone reluctant to click on a shortened URL, the full URL is https://lh3.googleusercontent.com/-BwS8oOqrxSQ/VUgoAVekqjI/A...

themartorana• 11 years ago

That's a significantly short amount of time to be able to address an issue before knowledge of the vulnerability becomes public knowledge.

I'm all for releasing a vulnerability after it a) is mitigated or b) becomes clear the responsible party has no plans to address the vulnerability in a timely fashion.

One day is in no way responsible unless the researchers were told pointedly that there was no plan to address the issues.

IMHO.

Terr_2• 11 years ago

In a later PDF, the lawyer complains about IOActive wanting access to company engineers on "a few days notice".

I really don't support people throwing around the DMCA, but if the company's lawyer's complaints are accurate (if) then IOActive sounds like they prioritized having a quasi-journalistic "scoop" over professionalism.

https://plus.google.com/118103547235676487972/posts/Sot7Tp1C...

kevingadd• 11 years ago

According to a comment from phar (one of the researchers) on the article, they gave a month's notice and CyberLock ignored it for 29 days:

we started a 30 day clock and if at any point someone had responded and said "we need more time", we could have provided more time (to some limit of course).. we even gave them a few extra days after they contacted us on day 29 since no one has done the math

A convenient approach since it lets them whine like children about how they weren't given enough lead time.

Lawtonfogle3• 11 years ago

Not saying they shouldn't be publicly disclosed in addition to private disclosure, but you have to give a company a fair chance to review the vulnerabilities and at least respond to you before you publish.

Why? They are the ones who let a vulnerable system onto the market. Why should I be forbidden from going public with legally obtained information when I have no contract with them? I should not share in any blame for their security vulnerabilities as I was never allowed to share it any of their profits (monetary or otherwise).

meowface3• 11 years ago

Simple ethics. If you contact them, you can at least give them time to patch the flaw for software, or time to start producing a new line of locks in this case. If you release it to the world before they're even aware of it, there's a gap where there is absolutely no mitigation whatsoever.

javajosh• 11 years ago

IOActive's findings enable a very difficult but devastating man-in-the-middle attack against anyone buying or storing these locks. It's really hard to clone a key to these locks, but once that's done the lock can be reassembled, and the attacker can use the copy to open it.

It's NOT like you can walk up to one with a thumb drive and pwn it.

copsarebastards• 11 years ago

IOActive's findings allow an attack where you can obtain one sample of the lock and gain the master key for the entire lock system.

So you walk up to the unguarded bike shed, take your time chopping off the lock with a hacksaw, and now you have access to the storage area. Normally the guard would come around before you'd be able to cut off that lock, but since you now have a key it's much quicker, and you wouldn't look suspicious to the guard anyway.

PhasmaFelis• 11 years ago

The advisory went on to say that "site keys" are stored in unencrypted, "cleartext" form that can be recovered from the lock cylinders.

Why do developers keep doing this? As a programmer, I've never worked with crypto implementation and I don't really know much about it on a practical level, but the one thing I do know is that you never store anything sensitive in plaintext. Ever! So how do so many devs who have, at the very least, spent far more time than I have Googling about crypto implementation, keep missing this?

It's as if there was an epidemic of wet kitchen floors sweeping the nation because thousands of plumbers, working independently, all repeatedly forgot to install traps under their sinks. Why does this one rank-amateur mistake keep happening?

madez10• 11 years ago

If you knew how cars are made...

swamp402• 11 years ago

When you start decapping chips and hitting them with lasers, there are all sorts of "cleartext" data you will be able to obtain.

hvidgaard• 11 years ago

That is true, but considering that this isn't your average website, but high security certified products there should have been security trained professionals working on the hardware, at the very least when they got the notice - they have no excuse.

Pyxl1012• 11 years ago

I don't see how this is an amateur mistake. Presumably the key material on the device needs to be available to its onboard computer. So, the computer needs to load it or work with it. You could encrypt it, sure, but with what key? Another key stored locally in plaintext?

Could you explain what alternative should be used in this case?

poizan422• 11 years ago

Use a salted hash like everybody else does with passwords?

dzhiurgis• 11 years ago

Wouldn't it be easier to just cut off the lock and replace with fake imitation that accept any key?

Sanddancer• 11 years ago

That'll just get you unrestricted access to that one area. This flaw lets you get the master key, and with that, you have unrestricted access to every locked room in the facility.

swamp402• 11 years ago

> An IOActive spokesman said the company has no indication CyberLock will take any legal action.

Well, IANAL, but I can pretty much guarantee they are going to get sued.

As many people say, you only get one reputation, and you must defend it vigorously.

And as many other people say, don't piss into the wind and expect not to get wet...

tehwalrus2• 11 years ago

Slander/Libel, in the UK where this isn't, has to contain falsehoods.

Can people in the US really sue each other for reputational damage even for saying only true things? If so, that is bizarre IMO.

cbd1984• 11 years ago

People can launch all kinds of suits which can't possibly result in victory. The courts won't try a case before they try it to see if the plaintiff would win.

JupiterMoon• 11 years ago

Slander/Libel, in the UK where this isn't, has to contain falsehoods.

Be careful this is a dangerous interpretation of UK law. Slander/Libel must contain some element that the person doing the saying/publishing cannot prove in court. Note the burden of proof lies on the person saying/writing rather than the person sueing.

(I am not a lawyer and this post does not constitute legal advice.)

blueskin_• 11 years ago

'Cyber'

Literally laughed out loud. It's just become too much of a joke now.

wglb• 11 years ago

Unclear on the concept: Moreover, IOActive's reverse engineering process required the use of skilled technicians, sophisticated lab equipment, and other costly resources not generally available to the public

This works so long as attackers have no more resources than the average guy in the street.

Lawyers threaten researcher over key-cloning bug in high-security lock

Related Stories